Mailinglist Archive: opensuse (4393 mails)

< Previous Next >
Re: [SLE] Re: [suse-security] Did SuSE hack ls or which?
  • From: Alexandr Malusek <Alexandr.Malusek@xxxxxxxxxx>
  • Date: 27 Nov 2001 17:41:30 +0100
  • Message-id: <86oflogo91.fsf@xxxxxxxxxxxxxxxxx>
Michael Nelson <michaelnel@xxxxxxxxxxxxx> writes:

> Strangely enough though, "strace which ls" reports:
>
> old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
> = 0x40016000
> write(1, "/bin/ls\n", 8/bin/ls
> ) = 8
> munmap(0x40016000, 4096) = 0
> _exit(0)
>
> ...but it doesn't get written to the screen:
>
> seahunt:~$ which ls
> seahunt:~$

Note that strace invokes /usr/bin/which and it reports /bin/ls on the stdout:

$ strace which ls 2>/dev/null
/bin/ls

The following is from bash(1):
: Aliases allow a string to be substituted for a word when
: it is used as the first word of a simple command.

In "strace which ls" the "which" is the second word and therefore it's
not interpreted as an alias while in "which ls" it is an alias.

--
Alexandr.Malusek@xxxxxxxxxx

< Previous Next >